{
  "cveId": "CVE-2026-63812",
  "url": "https://patchblox.com/security/cve/CVE-2026-63812",
  "summary": "CVE-2026-63812 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-63812, released July 20, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix incorrect FI_NO_EXTENT handling in __d...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()  When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388:  F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix  In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et-\u003Enode_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache.  This patch reverts commit ed78aeebef05 (\u0022f2fs: fix node_cnt race between extent node destroy and writeback\u0022), and remove the unnecessary zero check of et-\u003Enode_cnt.",
  "published": "2026-07-19T12:16:54Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00126,
  "epssPercentile": 0.02343,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.95-1",
      "fix": "DEBIAN-CVE-2026-63812",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63812",
      "released": "2026-07-20T12:58:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.3-1",
      "fix": "DEBIAN-CVE-2026-63812",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63812",
      "released": "2026-07-20T12:58:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}